Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit… (CVE-2026-85028)

CVE-2026-85028 describes a security flaw in the FPGA management tool installation component of the AWS FPGA Development Kit prior to version 2.3.4. The vulnerability arises from the creation of a temporary file in a directory with insecure, world-writable permissions. Local attackers can place crafted shell content at a predictable path in this directory, which the installation process reads after elevating its privileges, potentially allowing arbitrary code execution with root privileges. This is classified under CWE-379 (Creation of Temporary File in Directory with Insecure Permissions).

Successful exploitation allows a local user to execute arbitrary code with root privileges on the affected system. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.8 (High), reflecting the local attack vector but high impact on confidentiality, integrity, and availability.

Users should upgrade the AWS FPGA Development Kit to version 2.3.4 or later to remediate this vulnerability. No other mitigations or workarounds are specified. Patch status is confirmed by the vendor advisory indicating the fix is included in version 2.3.4.